Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9cf2377c authored by Rubin Xu's avatar Rubin Xu Committed by Automerger Merge Worker
Browse files

Merge "Fix work profile with unified challenge in HSUM" into udc-dev am: 15dc084b am: 5915d0f0 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/21590160



Change-Id: I6325a9a885d0c976e644858130adf14871652017
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c65d26f9 5915d0f0

services/core/java/com/android/server/locksettings/LockSettingsService.java

+18 −9
Original line number Diff line number Diff line
@@ -420,7 +420,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
        try (LockscreenCredential unifiedProfilePassword = generateRandomProfilePassword()) {

            setLockCredentialInternal(unifiedProfilePassword, profileUserPassword, profileUserId,

                    /* isLockTiedToParent= */ true);

            tieProfileLockToParent(profileUserId, unifiedProfilePassword);

            tieProfileLockToParent(profileUserId, parentId, unifiedProfilePassword);

            mManagedProfilePasswordCache.storePassword(profileUserId, unifiedProfilePassword);

        }

    }
@@ -1873,34 +1873,43 @@ public class LockSettingsService extends ILockSettings.Stub { 
    }



    @VisibleForTesting /** Note: this method is overridden in unit tests */

    protected void tieProfileLockToParent(int userId, LockscreenCredential password) {

        if (DEBUG) Slog.v(TAG, "tieProfileLockToParent for user: " + userId);

    protected void tieProfileLockToParent(int profileUserId, int parentUserId,

            LockscreenCredential password) {

        if (DEBUG) Slog.v(TAG, "tieProfileLockToParent for user: " + profileUserId);

        final byte[] iv;

        final byte[] ciphertext;

        final long parentSid;

        try {

            parentSid = getGateKeeperService().getSecureUserId(parentUserId);

        } catch (RemoteException e) {

            throw new IllegalStateException("Failed to talk to GateKeeper service", e);

        }



        try {

            KeyGenerator keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES);

            keyGenerator.init(new SecureRandom());

            SecretKey secretKey = keyGenerator.generateKey();

            try {

                mJavaKeyStore.setEntry(

                        PROFILE_KEY_NAME_ENCRYPT + userId,

                        PROFILE_KEY_NAME_ENCRYPT + profileUserId,

                        new java.security.KeyStore.SecretKeyEntry(secretKey),

                        new KeyProtection.Builder(KeyProperties.PURPOSE_ENCRYPT)

                                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

                                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

                                .build());

                mJavaKeyStore.setEntry(

                        PROFILE_KEY_NAME_DECRYPT + userId,

                        PROFILE_KEY_NAME_DECRYPT + profileUserId,

                        new java.security.KeyStore.SecretKeyEntry(secretKey),

                        new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT)

                                .setBlockModes(KeyProperties.BLOCK_MODE_GCM)

                                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)

                                .setUserAuthenticationRequired(true)

                                .setBoundToSpecificSecureUserId(parentSid)

                                .setUserAuthenticationValidityDurationSeconds(30)

                                .build());

                // Key imported, obtain a reference to it.

                SecretKey keyStoreEncryptionKey = (SecretKey) mJavaKeyStore.getKey(

                        PROFILE_KEY_NAME_ENCRYPT + userId, null);

                        PROFILE_KEY_NAME_ENCRYPT + profileUserId, null);

                Cipher cipher = Cipher.getInstance(

                        KeyProperties.KEY_ALGORITHM_AES + "/" + KeyProperties.BLOCK_MODE_GCM + "/"

                                + KeyProperties.ENCRYPTION_PADDING_NONE);
@@ -1909,7 +1918,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
                iv = cipher.getIV();

            } finally {

                // The original key can now be discarded.

                mJavaKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + userId);

                mJavaKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + profileUserId);

            }

        } catch (UnrecoverableKeyException

                | BadPaddingException | IllegalBlockSizeException | KeyStoreException
@@ -1919,7 +1928,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
        if (iv.length != PROFILE_KEY_IV_SIZE) {

            throw new IllegalArgumentException("Invalid iv length: " + iv.length);

        }

        mStorage.writeChildProfileLock(userId, ArrayUtils.concat(iv, ciphertext));

        mStorage.writeChildProfileLock(profileUserId, ArrayUtils.concat(iv, ciphertext));

    }



    private void setUserKeyProtection(@UserIdInt int userId, byte[] secret) {
@@ -2031,7 +2040,7 @@ public class LockSettingsService extends ILockSettings.Stub { 
                LockscreenCredential piUserDecryptedPassword = profileUserDecryptedPasswords.get(i);

                if (piUserId != -1 && piUserDecryptedPassword != null) {

                    if (DEBUG) Slog.v(TAG, "Restore tied profile lock");

                    tieProfileLockToParent(piUserId, piUserDecryptedPassword);

                    tieProfileLockToParent(piUserId, userId, piUserDecryptedPassword);

                }

                if (piUserDecryptedPassword != null) {

                    piUserDecryptedPassword.zeroize();

services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java

+3 −2
Original line number Diff line number Diff line
@@ -165,10 +165,11 @@ public class LockSettingsServiceTestable extends LockSettingsService { 
    }



    @Override

    protected void tieProfileLockToParent(int userId, LockscreenCredential password) {

    protected void tieProfileLockToParent(int profileUserId, int parentUserId,

            LockscreenCredential password) {

        Parcel parcel = Parcel.obtain();

        parcel.writeParcelable(password, 0);

        mStorage.writeChildProfileLock(userId, parcel.marshall());

        mStorage.writeChildProfileLock(profileUserId, parcel.marshall());

        parcel.recycle();

    }